Finland

The Act's administrative-fine mechanism, its main operative duty, reaches a provider, authorized representative, importer, distributor, or deployer of an AI system rather than a government body: Section 24 bars a fine against every named category of Finnish public authority. The Act supplements the EU AI Act within its Article 2 scope, but does not apply to the work of Parliament, the Parliamentary Ombudsman, or the Chancellor of Justice.

Section 6 designates Traficom (Transport- och kommunikationsverket) as the common contact point under AI Act Article 70, responsible for coordinating the authorities competent under this Act and reporting annually to the European Commission. Sections 3, 4, and 5 split market surveillance of high-risk AI systems, prohibited practices, and transparency obligations among named sectoral authorities.

Section 13 creates a Sanctions Board (Paafoljdsavgiftsnamnden) that decides an administrative fine under Sections 14 to 22 against a provider, authorized representative, importer, distributor, deployer, or notified body for breaching a duty under the AI Act.

Section 24 bars a fine against state authorities, state enterprises, municipal authorities, welfare regions, independent public-law institutions, parliamentary agencies, the Office of the President of the Republic, and the Evangelical Lutheran and Orthodox Churches in Finland and their parishes, against anyone already facing prosecution or a final conviction for the same act, and more than five years after the violation.

Section 19 bans manufacturing, offering, or otherwise distributing an image depicting a child sexually where the image is based on an actual situation involving a real child, or where the image is realistic, meaning it deceptively resembles a photograph of a situation in which a child is depicted sexually even though no real child was involved, by a fine or imprisonment for at most two years; the realistic-depiction branch reaches a wholly AI-generated or synthetically altered image on the same footing as an actual photograph.

Section 20 raises the penalty to imprisonment for at least four months and at most six years for an aggravated case, including where the depicted child is especially young or the image also shows serious violence against the child. Section 21 separately punishes possessing such an image, or paying or otherwise arranging access to it, by a fine or imprisonment for at most two years.

A narrow exception in Section 19 excuses production or distribution that is justified by the image's informational character or its evident artistic value.

A controller must notify the Data Protection Ombudsman without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Finland, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. The Data Protection Act adds no separate national breach notification regime.

The Data Protection Act specifies and supplements the General Data Protection Regulation (GDPR) within the GDPR's own scope of application. Drawn from the Ministry of Justice's official English translation: Section 5 sets the digital age of consent for information society services at 13, the lower bound GDPR Article 8 permits.

Section 24 assigns GDPR Article 83 administrative fines to a collegial Sanctions Board made up of the Data Protection Ombudsman and at least two Deputy Ombudsmen, with a three-member quorum, rather than to a single official, and bars a fine against central government and several other public bodies.

Section 27 disapplies specified GDPR articles for processing performed solely for journalistic, academic, artistic or literary purposes, including Chapter V transfer rules where applying them would infringe freedom of expression.

Transferring personal data of a person in Finland outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier.

Section 27 disapplies Articles 44 to 50 for processing performed solely for journalistic, academic, artistic or literary purposes where applying them would infringe freedom of expression or information; outside that narrow exemption no Finland-specific broadening or narrowing of Chapter V was found.

General Data Protection Regulation (GDPR) Articles 15 to 21 apply, including Article 22's qualified right against a decision based solely on automated processing with legal or similarly significant effect. Data Protection Act Section 33 restricts the Article 13/14 information duty, and Section 34 restricts the Article 15 access right, both on national security, defence, public order, offence prevention, or tax and public finance supervisory grounds.

Section 21 gives a right to refer a complaint to the Data Protection Ombudsman, with a three-month handling deadline and a right of appeal to an administrative court if that deadline is missed.

The Data Protection Ombudsman is Finland's supervisory authority. Section 24 assigns a General Data Protection Regulation (GDPR) Article 83 administrative fine to a collegial Sanctions Board chaired by the Ombudsman with at least two Deputy Ombudsmen and a three-member quorum, carries a ten-year limitation period from the infringement and a five-year limitation on enforcing an already-imposed fine, and bars a fine against central government authorities, municipal authorities, and several other named public bodies.

GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor, enforceable in the ordinary Finnish courts.

General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category.

Data Protection Act Section 6, read in full, lifts the Article 9(1) bar in eight named contexts (insurance claims, statutory duty, trade union membership for employment law, healthcare and social welfare delivery, anti-doping and disability sports, and research, statistics or archiving); none of the eight names biometric data, and the section carries no illustrative list or enumeration of biometric identifier types.

Biometric data processed for unique identification is therefore governed directly by GDPR Article 9 itself, with no Finland-specific narrowing or widening of the definition found.

Section 8 punishes unlawfully hacking into a computer system where data is processed, stored, or transmitted electronically, or into a separately protected part of such a system, by using an access code that does not belong to the offender or by otherwise breaking a protective measure, and separately punishes obtaining data from such a system by a special technical device without hacking into it, both as a computer break-in (tietomurto) punishable by a fine or imprisonment for at most two years; the section applies only where a more severe penalty is not provided elsewhere.

Section 8a raises the penalty to a fine or imprisonment for at most three years for an aggravated computer break-in, committed as part of an organized criminal group or in a particularly methodical manner, where the offense is also aggravated when assessed as a whole.

Section 13b(1) lets a person with lawful access to a work reproduce it for text-and-data-mining purposes and retain the copies solely for that purpose, unless the author has expressly and appropriately reserved that right.

Section 13b(2) gives research organizations and cultural heritage institutions with lawful access a broader exception to reproduce a work for text-and-data-mining in scientific research and retain the copies for that research, including later verification of research results, provided the copies are accessible only to those entitled to them; that broader exception cannot be overridden by contract or prevented by technical means.

Section 49 gives the maker of a list, table, program, or other work combining a large quantity of information, or a database whose content required substantial investment to gather, verify, or present, the exclusive right to control the whole of its content, or a qualitatively or quantitatively substantial part of it, by reproducing it and making it available to the public.

The right lasts until 15 years have passed from the year the work was completed, or, if the work was made available to the public before that period ended, 15 years from the year it was first made available. A contract term that prevents or restricts a lawful user of a published work from using a qualitatively or quantitatively insubstantial part of its content for any purpose is void.

The Laki eräiden tuotteiden kyberkestävyydestä sekä kyberturvallisuussertifioinnista (439/2026), known colloquially as the Kyberkestävyyslaki, specifies and supplements the directly applicable Cyber Resilience Act (Regulation (EU) 2024/2847) and its national application, rather than restating the Regulation's own essential cybersecurity requirements, which are documented at the European Union level and are not repeated here.

Section 7 leaves a manufacturer's duty to report an actively exploited vulnerability or a severe security-affecting incident entirely to Article 14 of the Regulation, adding only that the report goes to Finland's CSIRT unit, which must in turn notify the market surveillance authority under the Regulation's Article 16(3); Section 8 lets a manufacturer or other party voluntarily report a vulnerability, cyberthreat, incident or near miss to the CSIRT unit under Article 15, and information reported this way cannot be used against the reporter in a criminal investigation or an administrative decision without consent.

Section 15 names Liikenne- ja viestintävirasto (Traficom) as the Regulation's Article 52 market surveillance authority, except that Section 16 assigns a high-risk AI system within the Regulation's scope to the market surveillance authority the Act on the Supervision of Certain Artificial Intelligence Systems designates instead.

Chapter 6 sets Finland's own administrative penalty amounts within the bands Regulation Article 64 allows a Member State to set: up to EUR 15,000,000 or 2.5 percent of a manufacturer's worldwide turnover for breaching the essential cybersecurity requirements of Article 13 and Annex I Part I (Section 31, first paragraph); up to EUR 10,000,000 or 2 percent for a manufacturer's other obligations, or for an authorised representative's, importer's, distributor's or notified body's own obligations (Section 31 second paragraph and Sections 32 to 35); up to EUR 5,000,000 or 1 percent for other Regulation-related breaches, such as supplying incorrect or misleading information to a notified body or the market surveillance authority (Section 36); and a flat EUR 100,000 cap for a cybersecurity-certification breach (Section 37).

Finland's Act entered into force 1 June 2026, ahead of the Regulation's own Article 14 reporting duty, which applies from 11 September 2026.

Sections 7 to 10 of the Kyberturvallisuuslaki require an entity within scope to identify, assess and manage the risks to the network and information systems it uses in its operations or to provide its services, and to act to prevent or minimise an incident's impact on its operations, their continuity, the recipients of its services and other services (Section 7).

The entity must maintain a documented cybersecurity risk-management operating model (Section 8) whose management measures cover, at minimum, twelve areas matching NIS2 Article 21(2): risk-management policy and effectiveness assessment; network and information system security policy; supply-chain security, including vulnerability handling and disclosure for direct suppliers and service providers; asset management and identification of security-critical functions; personnel security and cybersecurity training; access-control and authentication procedures; cryptography policy; incident detection and handling; backup, recovery planning, crisis management and business continuity; basic cyber-hygiene practices; and, where appropriate, multi-factor or continuous authentication (Section 9).

The entity's board, supervisory board or chief executive is responsible for organising the implementation and oversight of this risk management, approves the operating model, and must hold sufficient familiarity with cybersecurity risk management (Section 10).

Liikenne- ja viestintävirasto (Traficom) is the supervisory authority for Annex I items 1 to 7, covering transport, digital infrastructure and ICT service management, and for Annex II items 1 to 5, covering postal and courier services and the online marketplace, online search engine and online social-networking-platform digital-service-providers flagged here; the Act designates seven further sector authorities for its other Annex I and II classes.

An intentional or grossly negligent failure of the Section 7, 8 or 9 duties is subject to an administrative penalty of up to EUR 10,000,000 or 2 percent of worldwide annual turnover for an essential entity and up to EUR 7,000,000 or 1.4 percent for any other bound entity (Section 38), mirroring NIS2 Article 34(4) and (5), though Section 35 exempts state authorities, state enterprises, wellbeing regions and joint authorities, municipal authorities, independent public-law institutions, parliamentary agencies, the Office of the President, and the Evangelical Lutheran and Orthodox Churches of Finland and their parishes from the penalty itself, without exempting them from the underlying duty.

Beyond the entities that meet or exceed the medium-enterprise thresholds of Commission Recommendation 2003/361/EC while carrying out an Annex I or Annex II activity, Section 3 binds a narrower set of entities regardless of size: a provider of public electronic communications networks or publicly available electronic communications services, a trust service provider, a top-level-domain registry operator, a DNS service provider, and a critical entity designated outside the public administration sector under the Act on Protecting and Improving the Resilience of Critical Infrastructure (310/2025).

Section 1 excludes the public administration sector named in NIS2 Annex I point 10 from this Act's own scope, assigning that sector instead to the Act on Information Management in Public Administration (906/2019), a different Finnish instrument not researched here.

Sections 11 to 14 of the Kyberturvallisuuslaki require a bound entity to notify its supervisory authority without delay of a significant incident, defined as one that has caused or could cause a serious service disruption or considerable financial loss to the entity, or that has affected or could affect another natural or legal person with considerable material or immaterial damage.

An early notification is due within 24 hours of detecting the significant incident and a follow-up notification within 72 hours of detection, both clocks running from the moment of detection rather than from each other (Section 11). A trust service provider whose trust services are affected must instead file its follow-up notification within 24 hours rather than 72 (Section 11).

An interim report is due on the supervisory authority's request, or within one month of the follow-up notification if the incident is long-running (Section 12), and a final report is due within one month of the follow-up notification, or within one month of the incident's resolution if it is still ongoing at that point, describing the incident, its likely root cause, mitigation measures taken and any cross-border effects (Section 13).

Where a significant incident is likely to adversely affect an entity's service, or a significant cyberthreat may affect the recipients of that service, the entity must notify them without delay of the incident, the threat, and available countermeasures (Section 14).

Separately, Section 22 makes the Act's CSIRT unit, not the affected manufacturer or provider, the NIS2 Article 12 coordinator for coordinated vulnerability disclosure: it receives reports of vulnerabilities, which may be submitted anonymously, and handles the necessary follow-up. The same penalty bands and exemptions described on this jurisdiction's companion risk-management row apply to a failure of the Section 11, 12 or 13 reporting duties.

Section 5 lets a provider offer an audiovisual programme only if it carries a clearly visible age-limit and content mark under Section 16, or, for a programme unambiguously intended only for those 18 and older, a clear mark of the 18-year age limit alone. Section 16 requires a programme harmful to a child's development to be classified 7, 12, 16, or 18 years with a content symbol, and lets a programme intended solely for adults skip classification if it instead carries the 18-year mark.

Section 6 prohibits offering a programme rated 18 to a minor at all, subject to a broadcast-timing exception. The same section requires the provider to keep a programme rated 7, 12, or 16 from being watched by a younger child through broadcast timing, making a blocking service available, or otherwise verifying age when the programme is offered. The National Audiovisual Institute supervises compliance and maintains the public register of classified programmes under Sections 17 and 18.

Section 50 gives the publisher of a press publication the exclusive right to determine over its publication by reproducing copies of it and communicating it to the public for a commercial purpose, in a way that lets a member of the public access it from a place and at a time individually chosen by them. The right does not apply to an individual user's private or non-commercial use of the press publication, a hyperlink, or an individual word or a very short extract of the press publication.

A press publication is defined as a collection composed mainly of journalistic literary works, not published for a scientific or academic purpose, that forms a separate periodically appearing or regularly updated issue under one title, aims to inform the public about news or other subjects, and is disseminated to the public by any medium at the publisher's initiative, editorial responsibility, and control.

The right lasts until two years have passed from the end of the year the press publication was published. It does not apply to a press publication first published before 6 June 2019. It leaves the author's own right in a work included in the publication untouched, and the author of such a work has a right to an appropriate share of the publisher's income from exercising the publisher's right.